CVE-2026-13592

{"id": "CVE-2026-13592", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-13592", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-01T14:08:09.537127Z"}}], "cvssMetricV2": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.5, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@vuldb.com", "affectedData": [{"cpes": ["cpe:2.3:a:liftoff-sr:cipster:*:*:*:*:*:*:*:*"], "vendor": "liftoff-sr", "modules": ["EtherNet IP Message Handler"], "product": "CIPster", "versions": [{"status": "affected", "version": "e8e9dba09bf56962807d3504b783ccdb6287f3e4"}]}]}], "published": "2026-06-29T18:16:37.103", "references": [{"url": "https://github.com/liftoff-sr/CIPster/", "source": "cna@vuldb.com"}, {"url": "https://github.com/liftoff-sr/CIPster/commit/3a0159ed43125dcd024a1965f0289cb186bae9ff", "source": "cna@vuldb.com"}, {"url": "https://github.com/liftoff-sr/CIPster/issues/48", "source": "cna@vuldb.com"}, {"url": "https://github.com/liftoff-sr/CIPster/issues/48#issuecomment-4596727632", "source": "cna@vuldb.com"}, {"url": "https://github.com/user-attachments/files/28452971/poc.zip", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/cve/CVE-2026-13592", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/submit/844566", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/374596", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/374596/cti", "source": "cna@vuldb.com"}, {"url": "https://github.com/liftoff-sr/CIPster/issues/48", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-119"}, {"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in liftoff-sr CIPster up to e8e9dba09bf56962807d3504b783ccdb6287f3e4. Affected by this issue is the function BufWriter::append of the component EtherNet IP Message Handler. Performing a manipulation results in out-of-bounds write. Remote exploitation of the attack is possible. The exploit is now public and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The patch is named 3a0159ed43125dcd024a1965f0289cb186bae9ff. To fix this issue, it is recommended to deploy a patch."}, {"lang": "es", "value": "Una vulnerabilidad fue detectada en liftoff-sr CIPster hasta e8e9dba09bf56962807d3504b783ccdb6287f3e4. Afectada por este problema es la funci\u00f3n BufWriter::append del componente Gestor de Mensajes EtherNet IP. Realizar una manipulaci\u00f3n resulta en escritura fuera de l\u00edmites. La explotaci\u00f3n remota del ataque es posible. El exploit es ahora p\u00fablico y puede ser usado. Este producto sigue un enfoque de lanzamiento continuo para la entrega continua, por lo tanto, los detalles de la versi\u00f3n para las versiones afectadas o actualizadas no se proporcionan. El parche se llama 3a0159ed43125dcd024a1965f0289cb186bae9ff. Para solucionar este problema, se recomienda desplegar un parche."}], "lastModified": "2026-10-25T21:10:00.770", "sourceIdentifier": "cna@vuldb.com"}